goldpocket[.]one

This domain, goldpocket.one, is identified as a high-risk brand impersonation threat designed to facilitate investment scams. Analysis indicates the domain mimics legitimate financial platforms, offering fraudulent services under the guise of a "One-Stop Global Investment Platform" for forex, commodities, stocks, indices, cryptocurrencies, gold, and oil. No specific drainer kit is confirmed, but the domain’s structure and content align with known investment fraud schemes targeting unsuspecting users seeking financial opportunities.

Technical indicators reveal the domain was registered on April 28, 2026, through Gname.com Pte. Ltd. It resolves to the IP address 188.114.97.3 and employs Cloudflare for hosting, alongside HTTP/3 and HSTS for enhanced security misdirection. Google Safe Browsing flags the domain with a "SOCIAL_ENGINEERING" classification, while VirusTotal reports 16 out of 95 security vendors detecting it as malicious. The domain appears on four security blocklists, and its SSL certificate is issued by Google Trust Services, a common tactic to appear legitimate. Gridinsoft assigns a trust score of 0/100, further confirming its malicious nature.

As of the latest assessment, goldpocket.one has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the risk of reemergence remains, as threat actors frequently reuse or rebrand domains for similar campaigns. Users are advised to verify investment platforms through official channels, avoid interacting with unsolicited financial offers, and monitor for updates on this domain’s status. Organizations should block the domain and associated IP address in network security controls to prevent potential exposure.